BotBlocker Security <= 1.7.7 - Unauthenticated Two-Factor Authentication Bypass
- ID
- WPSEC-2026-2616
- Plugin
- BotBlocker Security – Complete security platform (botblocker-security)
- Affected
- from 1.6.9 before 1.7.8
- Remediation
- Update to 1.7.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- BotBlocker Security on WPSec AttackSurface
- Fix released
- Published
Description
The BotBlocker Security plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions 1.6.9 up to, and including, 1.7.7. This is due to the plugin tracking the pending 2FA challenge in a single per-user '_2fa_pending' user meta flag instead of per login session. The flag was set only by the core 'login_redirect' filter and was deleted as soon as any session of the account completed 2FA. Without the flag, the session was treated as fully verified. This makes it possible for unauthenticated attackers who know the password of a user whose role requires 2FA to obtain a fully trusted session without a valid second factor. They can log in through a login path that does not apply the 'login_redirect' filter, or log in at the same time as the legitimate user and wait for that user to complete 2FA in their own session.
References
- https://wpsec.com/vuln/WPSEC-2026-2616/
- https://plugins.svn.wordpress.org/botblocker-security/tags/1.7.8/
- https://wordpress.org/plugins/botblocker-security/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS